registry / @cursorx/cli / 0.0.9

@cursorx/cli@0.0.9

Local installer for CursorX — custom models in Cursor with your own API keys, via a 127.0.0.1 router. Unofficial; not affiliated with Cursor.

Static Scan Results

scanned 16h ago · by rust-scanner

Static analysis flagged 12 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

EnvironmentVarsFilesystem

Supply chain

MinifiedObfuscatedUrlStrings

Manifest

NoLicense

scanned 2 file(s), 1.05 MB of source, external domains: 127.0.0.1

Source & flagged code

4 flagged

dist/cli.jsView file

1#!/usr/bin/env node L2: const _0x449f82=_0x3da5;(function(_0x2f29e4,_0x62f7b){const _0x494b53=_0x3da5,_0x520145=_0x2f29e4();while(!![]){try{const _0x21438b=-parseInt(_0x494b53(0x296))/(0x6c4*-0x5+0xab*0x1...

High

Obfuscated Payload Loader

Source contains an obfuscator-style string-array loader that reconstructs and executes hidden code.

dist/cli.jsView on unpkg · L1

vsix/cursorx-0.0.9-darwin-x64.vsixView file

•path = vsix/cursorx-0.0.9-darwin-x64.vsix kind = high_entropy_blob sizeBytes = 4387325 magicHex = [redacted]

High

Ships High Entropy Blob

Package ships high-entropy non-source blobs.

vsix/cursorx-0.0.9-darwin-x64.vsixView on unpkg

•path = vsix/cursorx-0.0.9-darwin-x64.vsix kind = compressed_blob sizeBytes = 4387325 magicHex = [redacted]

Medium

Ships Compressed Blob

Package ships compressed or archive-like blobs.

Source & flagged code

4 flagged · loading source

dist/cli.jsView file

Static Scan Results

Decision evidence

Source & flagged code

Source & flagged code

Findings

Source & flagged code